CVE-2025-11554
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. It affects unknown functionality in the file app/Http/Controllers/AccessLevelController.php of the User Type Handler component. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
The organization may be exposed to unauthorized privilege escalation, potentially allowing an attacker to access sensitive data or administrative functions.
Recommendation
It is recommended to immediately upgrade to the latest version of i-Educar and apply security patches to avoid exploitation of the publicly available exploit.
Other vulnerabilities in Portabilis i-Educar
See all- CVE-2026-2015Medium
A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.
- CVE-2025-10846Medium
A vulnerability in Portabilis i-Educar up to 2.10 affects unknown code in the file /module/ComponenteCurricular/edit. Manipulation of the argument ID causes SQL injection. The attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-10845Medium
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in SQL injection. The attack can be executed remotely. The exploit has been made public and could be used.
- CVE-2025-10608Medium
A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.
- CVE-2025-10605Medium
A security flaw has been discovered in Portabilis i-Educar up to 2.10, affecting /agenda_preferencias.php. Manipulation of the tipoacao argument results in cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been publicly released.
- CVE-2025-10591Low
A cross-site scripting vulnerability was identified in Portabilis i-Educar up to version 2.10, affecting the file /intranet/educar_funcao_cad.php (Editar Função Page component). Manipulation of the abreviatura/tipoacao arguments allows remote exploitation. The exploit has been publicly disclosed and could be used.
- CVE-2025-10590Medium
A Cross-Site Scripting (XSS) vulnerability was discovered in Portabilis i-Educar up to version 2.10 in the file /intranet/educar_usuario_det.php. By manipulating the ref_pessoa argument, an attacker can inject malicious script. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.
- CVE-2025-10584Low
A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Such manipulation of the argument nm_anotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- CVE-2025-10073Medium
A vulnerability in Portabilis i-Educar up to 2.10 affects an unknown function in /module/Api/turma. Manipulation leads to improper authorization. Remote attack possible, exploit publicly disclosed.
- CVE-2025-10013Medium
Portabilis i-Educar up to 2.10 has an improper access control vulnerability in /exportacao-para-o-seb. Manipulation results in unauthorized access.
Original NVD description (English source)
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS